IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain hard-coded credentials that could let a remote, unauthenticated attacker gain full administrative control.
What Is It
CVE-2026-17403 is a hard-coded credentials weakness (CWE-798) in IBM API Connect. IBM's PSIRT reported it, and NVD published it on November 7, 2026. According to the description, a remote attacker could use the embedded credentials to gain full administrative control of an affected deployment.
IBM gives it a CVSS v3.1 base score of 9.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The vector means:
- The attack runs over the network.
- The attacker needs no privileges and no user interaction.
- Attack complexity is rated High.
- Scope is Changed, so the impact can reach beyond the vulnerable component.
NVD lists the record as "Awaiting Analysis," so NVD has not yet published its own score.
Why It Matters
API Connect is an API management platform. Full administrative control of it gives an attacker high impact to confidentiality, integrity and availability, as the CVSS metrics reflect. Because no prior authentication is required, any exposed instance is a potential target. The High attack complexity rating suggests some conditions outside the attacker's control must be met first, but the available data does not say what they are.
KEV status: As of November 7, 2026, CVE-2026-17403 did not appear in the CISA Known Exploited Vulnerabilities catalog. The catalog changes often, so check its current status. No public source cited here confirms active exploitation, and no federal remediation deadline has been set.
What's Vulnerable
These IBM API Connect releases are affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running any release in these ranges should treat their deployments as exposed until they confirm otherwise.
Patch Status
The NVD record does not list fixed versions or specific remediation steps. IBM has published two support pages linked to this CVE (nodes 7295635 and 7295637). Administrators should read both pages for IBM's remediation guidance and fixed releases, and apply what IBM recommends for their version branch.
Until a fix is applied, it is prudent to limit network exposure of API Connect management interfaces. With hard-coded credentials, a fix that only changes configuration may not be enough, so follow the vendor guidance closely.